Extracted

• • Target
    ORDER N. F-1676.23.bat.exe
  • Size 851KB
  • SHA256 ea0d7f34cfddec8c57ddf23bfc5eab2c1692f1b3f5e8fdd6f4f7f8596e478d9d
  • MD5 358b29dc083fc85dad2d7fc5d37ac767
  • SHA1 862f8241df559ae7607e5900dae86bee454bea9a
  • SHA512 ae9667504f70aef95dd9708ae8e2bbfc789cd0fff64bed6608433f48edfba193889e72decc0385d9875f16287e1feec4717c52a97510575ca1d0556410e1d0d5
  • SSDEEP 12288:DrQzRa4+sxyjG9IzKjlauWV/dSw1nMks/jsexFacI5u0tnUoOiUQkxcwiKhtC:DmaSxjyOj9WVgMMO+ZIAdV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2